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November 4, 2011 



The President 
The White House 
1600 Pennsylvania Avenue 
Washington, D.C. 20500 

Dear Mr. President: 



The Controlled Unclassified Information (CUI) Office of the National Archives and Records 
Administration (NARA) is pleased to submit its first report on the implementation of Executive Order 
13556, "Controlled Unclassified Information," dated November 4, 2010. This report covers CUI program 
progress from your issuance of the Order up to September 30, 2011. The submission of this report 
occurs as NARA, in its capacity as the Executive Agent for CUI, is in the initial stages of shaping the CUI 
program. As per the Order, our goal is to establish a system to manage unclassified information that 
requires safeguarding or dissemination controls. 

In pursuit of the goals and requirements set forth in the Order, NARA consulted with affected 
departments and agencies and took the steps necessary to develop and issue guidance essential to 
implement the Order. After also consulting with State, local, tribal, and private sector stakeholders as 
well as representatives of the public, NARA issued the "Controlled Unclassified Information (CUI) Office 
Notice 2011-01: Initial Implementation Guidance for Executive Order 13556," dated June 9, 2011. This 
Notice advises agencies as they prepare to standardize their handling of controlled unclassified 
information. 



Continuing our work with affected agencies, NARA led a robust interagency process to establish an 
authoritative, executive branch-wide structure of defined categories for CUI. NARA held working groups 
with department and agency subject matter experts to review their proposals for commonly held 
categories. As each working group progressed, NARA approved initial categories to be published, 
beginning on November 4, 2011, in the registry required by the Order. This registry will be publically 
accessible and, when fully developed, will consist of all CUI terms utilized by the executive branch to 
include categories, subcategories, and markings, as well as applicable safeguarding, dissemination, and 
decontrol procedures. 

NARA is committed to leading vigorous, inclusive interagency efforts to ensure the initial and ongoing 
success of CUI implementation across the executive branch. NARA will continue to monitor agency 
progress and, in consultation with affected agencies and the Office of Management and Budget, establish 
deadlines for phased implementation of the Executive Order. 

Respectfully, 




John P. Fitzpatrick J 

Director, Information Security Oversight Office 
National Archives and Records Administration 
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CONTROLLED UNCLASSIFIED INFORMATION 

Historically, executive departments and agencies have employed ad-hoc, agency-specific policies, 
procedures, and markings to safeguard and control the dissemination of Sensitive But Unclassified 
(SBU) information. As a result, there are more than 100 different procedural regimes for handling 
such information across the executive branch. The lack of an enterprise approach to such guidance 
has resulted in a confusing, patchwork system characterized by inconsistent marking and 
safeguarding of documents, led to unclear or unnecessarily restrictive dissemination policies, and 
created impediments to authorized information sharing. 

On November 4, 2010, President Obama signed Executive Order 13556 (the Order) 1 , establishing a 
Controlled Unclassified Information (CUI) program to manage all unclassified information that 
requires safeguarding and/or dissemination controls pursuant to and consistent with applicable 
law, regulations, and Government-wide policies. The Order designates the National Archives and 
Records Administration (NARA) as the Executive Agent (EA) to implement the Order and to oversee 
department and agency actions to ensure compliance with the Order. NARA established the CUI 
Office, within the Information Security Oversight Office, to manage the program and fulfill EA 
responsibilities per the Order. 

CUI PROGRAM PROGRESS 

The agency-driven approach of the Order prescribes an ongoing conversation between the EA, 
federal departments and agencies, the private sector, representatives of the public, and State, local, 
and tribal stakeholders to consolidate and standardize an executive branch-wide taxonomy and 
policy for CUI. 

In order to develop initial implementing guidance for CUI, the EA hosted, from January to April 
2011, multiple working group meetings with affected executive branch departments and agencies, 
as well as representatives of State, local, and tribal entities, the private sector, and representatives 
of the public. After consultation with relevant CUI stakeholders, the EA issued "Controlled 
Unclassified Information (CUI) EA Notice 2011-01: Implementation Guidance for Executive Order 
13556" 2 on June 9, 2011. This guidance applies to all executive branch agencies that create or 
handle unclassified information requiring safeguarding or dissemination controls pursuant to and 
consistent with applicable law, regulations, and Government-wide policies. The issuance of this 
guidance provides baseline requirements for agency-specific CUI policies and procedures and will 
ensure the standardization of government-wide practice as it pertains to unclassified information 
for which controls are prescribed. 



1 Executive Order 13556 "Controlled Unclassified Information," dated November 4, 2010 

2 "Controlled Unclassified Information (CUI) EA Notice 2011-01: Implementation Guidance for Executive Order 
13556," dated June 9, 2011. 
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The Order tasked departments and agencies to review all categories, subcategories, and markings 
they use to designate unclassified information requiring safeguarding and dissemination controls. 
Departments and agencies were required to submit their initial proposed categories, subcategories, 
and markings to the EA for review and approval on or before May 3, 2011. 

Beginning in May and extending through July 2011, the EA reviewed all submissions and 
consolidated similar proposals to eliminate redundancies and provide consistency among like 
categories. In August 2011, the EA began an interagency process to establish an authoritative, 
executive branch-wide structure of defined categories for CUI. After consolidating the most 
common categories, the EA held working groups with agencies and subject matter experts to 
review these commonly proposed categories. 

As each working group progressed, the EA, in consultation with affected agencies, approved initial 
CUI categories published in a public registry on November 4, 2011. This registry reflects 
authorized categories, subcategories, and associated markings along with applicable safeguarding, 
dissemination, and decontrol procedures. When fully developed, the registry will consist of all CUI 
terms utilized by the executive branch. 

In conjunction with the issuance of Executive Order 13556, the EA comprehensively updated the 
CUI website (http://www.archives.gov/cui/) to reflect the background, current status, and 
anticipated future direction of the program. Website content includes CUI program chronology and 
milestones, training, frequently asked questions, and department and agency resources. Most 
importantly, the CUI website hosts the public registry. 

The EA has also produced CUI awareness and Executive Order training modules. These computer- 
based tools are designed for stakeholders at all levels, and are publicly available at the CUI website 
for either direct access or download. CUI Awareness training discusses the history of CUI and the 
need for consistent government-wide policy. Executive Order training introduces the Presidential 
directive to create a collaborative and standardized approach for managing CUI. 

The EA participated in outreach events, representing the program at conferences, symposiums, and 
meetings for a range of audiences, including federal, State, local, and tribal governments, the private 
sector, law enforcement, military, academic, and public interest entities. Each event provided 
opportunities for stakeholders to learn more about CUI, ask questions regarding implementation, 
and provide feedback or recommendations on how to improve the overall CUI program. 

THE WAY AHEAD 

The EA will continue to lead this ongoing interagency process to establish an executive branch-wide 
definition and taxonomy of all categories for CUI and to develop the CUI registry. In contrast to the 
former SBU system, the CUI registry will contain common definitions and protocols for describing 
how unclassified information should be marked, and what procedures should be followed for 
properly safeguarding, disseminating, and decontrolling unclassified information, based on law, 
regulation, and Government-wide policy. The registry will promote better protection of such 





SUMMARY OF FY2011 
PROGRAM ACTIVITY 



information internally and externally by providing clear and readily accessible direction in 
addressing the deficiencies of the present SBU system, particularly inconsistent marking and 
safeguarding as well as confusion regarding dissemination. 

In accordance with guidance issued by the EA, departments and agencies are currently drafting 
plans that reflect their approach to implementing their internal CUI programs. These compliance 
plans outline agency strategies to deal with governance, policy, training, technology and oversight 
considerations, as well as the timelines specific to their agency-wide implementation. These initial 
plans are to be submitted to the EA by December 6, 2011. The EA will review and, in consultation 
with affected agencies and the Office of Management and Budget, establish deadlines for phased 
implementation by agencies. Follow-on guidance will be issued as the schedule of the CUI program 
is developed. 

In the future, agency heads are expected to establish and manage an agency CUI program that 
develops and implements agency procedures, roles, and responsibilities regarding CUI in 
accordance with the Executive Order, provides for required training for affected personnel 
regarding implementation and maintenance of the agency’s CUI program, and creates a self- 
inspection program to ensure compliance with the Order. The EA will serve as a resource for 
departments and agencies to ensure coordination and implementation of CUI policy throughout the 
executive branch. Outreach efforts will continue, with increased attention to stakeholder groups 
that are new to the CUI effort. 

Our ultimate goal is to establish an executive branch-wide program to standardize and simplify the 
way agencies handle unclassified information that requires safeguarding or dissemination controls. 
The program will emphasize and enhance the openness, transparency, and uniformity of 
government-wide practices. 
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